diff options
author | Phil Sutter <phil@nwl.cc> | 2016-11-25 18:52:55 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-11-29 23:03:50 +0100 |
commit | f1cd86ddcf1726b91aedb9ef916b380edc8c2b61 (patch) | |
tree | 635cf902880c1e5eb91c961b4792c2b098787940 /iptables/nft-ipv6.c | |
parent | 3531d7cc07d8121bcfd5379978d4d40c489c6dd5 (diff) |
nft_ipv{4,6}_xlate: Respect prefix lengths
This was an annoying bug in the translator since it silently dropped
crucial information which is easily overlooked:
| $ iptables-translate -A INPUT -s 192.168.0.0/24 -j ACCEPT
| nft add rule ip filter INPUT ip saddr 192.168.0.0 counter accept
| $ ip6tables-translate -A INPUT -s feed:babe::/64 -j ACCEPT
| nft add rule ip6 filter INPUT ip6 saddr feed:babe:: counter accept
To my surprise, this fix works really well in all kinds of situations:
| $ iptables-translate -A INPUT -s 1.2.3.4/0 -j ACCEPT
| nft add rule ip filter INPUT counter accept
|
| $ iptables-translate -A INPUT -s 1.2.3.4/23 -j ACCEPT
| nft add rule ip filter INPUT ip saddr 1.2.2.0/23 counter accept
|
| $ iptables-translate -A INPUT -s 1.2.3.4/24 -j ACCEPT
| nft add rule ip filter INPUT ip saddr 1.2.3.0/24 counter accept
|
| $ iptables-translate -A INPUT -s 1.2.3.4/32 -j ACCEPT
| nft add rule ip filter INPUT ip saddr 1.2.3.4 counter accept
|
| $ iptables-translate -A INPUT -s 1.2.3.4/255.255.0.0 -j ACCEPT
| nft add rule ip filter INPUT ip saddr 1.2.0.0/16 counter accept
Ditto for IPv6.
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft-ipv6.c')
-rw-r--r-- | iptables/nft-ipv6.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index 8bebf6be..c475b8e9 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -387,6 +387,7 @@ static void nft_ipv6_save_counters(const void *data) } static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr, + const struct in6_addr *mask, int invert, struct xt_xlate *xl) { char addr_str[INET6_ADDRSTRLEN]; @@ -395,7 +396,8 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr, return; inet_ntop(AF_INET6, addr, addr_str, INET6_ADDRSTRLEN); - xt_xlate_add(xl, "%s %s%s ", selector, invert ? "!= " : "", addr_str); + xt_xlate_add(xl, "%s %s%s%s ", selector, invert ? "!= " : "", addr_str, + xtables_ip6mask_to_numeric(mask)); } static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) @@ -425,9 +427,9 @@ static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl) } } - xlate_ipv6_addr("ip6 saddr", &cs->fw6.ipv6.src, + xlate_ipv6_addr("ip6 saddr", &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk, cs->fw6.ipv6.invflags & IP6T_INV_SRCIP, xl); - xlate_ipv6_addr("ip6 daddr", &cs->fw6.ipv6.dst, + xlate_ipv6_addr("ip6 daddr", &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk, cs->fw6.ipv6.invflags & IP6T_INV_DSTIP, xl); ret = xlate_matches(cs, xl); |